Cybersecurity, learned like a practitioner.
24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.
Intermediate · modules
Modules tagged Intermediate. Use the sidebar to narrow by track or topic.
Why GPO Defaults Matter
GPOs have defaults. Defaults from when AD launched. “Not Defined” usually means “system default” — which may be insecure. Examples: NTLM still allowed. LM hash still stored on some configs. Anonymous SID enumeration enabled. Each is a backdoor that nobody actively turned on. The mindset: assume nothing is restricted unless explicitly restricted. Apply CIS or […]
The Time Aspect of Kerberos
TGT typical lifetime: 10 hours. Forged Golden Ticket: any lifetime. Until krbtgt rotates, attacker maintains DA via tickets attacker forges. Service ticket cache: residual access for hours after permission revocation. Cache flushing rare; impact uncertain. The mindset: time-bound credentials need time-bound revocation, not just permission revocation.
Cross-Forest, Cross-Tenant Trust
M&A: company A acquires company B. Trust between forests established for “convenience.” Compromise of one becomes compromise of both. Hybrid AD + Entra: AD Connect bridges; compromise of either side reaches the other. Multi-tenant Entra: B2B guest accounts persist; compromise of guest tenant reaches host. The mindset: every trust relationship is a control merge. Document; […]
Layer 3 vs Layer 7 Mindsets
Network team thinks in subnets, ACLs, firewalls — Layer 3. App team thinks in HTTP semantics, auth, business logic — Layer 7. Attackers exploit the gap. Network ACL allows port 443 from 10.0.0.0/8 to web tier. Web tier app trusts client IP from header. Internal subnet of compromised laptop hits web tier with forged X-Forwarded-For. […]
NAT Doesn’t Mean Safe
NAT was an addressing patch. It happens to drop unsolicited inbound packets. Many treat it as a firewall. It isn’t. NAT doesn’t inspect outbound. Compromised host phones home freely. NAT doesn’t protect peer-to-peer; UPnP / hole-punching exists. NAT doesn’t protect against same-segment attacks. The mindset: every “NAT protects us” claim should be replaced with “outbound […]
Cleartext Is Forever
An adversary records your encrypted traffic today. Stores it. Years later, quantum computer breaks the key exchange. Decrypts. This isn’t hypothetical. Nation-state adversaries have been recording for years. Long-lifespan secrets — IP, state secrets, banking credentials — are exposed even when transmitted over modern TLS today. The mindset: data with multi-decade sensitivity needs post-quantum protection […]
The Cookie Confusion Cascade
Cookies are the most-misunderstood browser feature. Domain attribute, path, SameSite, Secure, HttpOnly, Partitioned — each affects when the browser sends the cookie. Combinations produce surprising behaviour. Examples that catch defenders off guard: cookie set on parent domain visible to subdomain (intentional, abuseable); SameSite=Lax allows top-level navigation cookies (CSRF window); Partitioned cookies behave differently per top-level […]
Authentication vs Authorization Split
Authentication: who are you. Authorization: what can you do. Most security education conflates them. Most bugs live in the gap. An authenticated user is not authorized for everything they ask. Authorization is per-resource, per-action, often per-attribute. IDOR exists because authn is correct but authz is missing. The mindset: at every endpoint, two questions: “is this […]
Browser Origin Boundaries
Same-Origin Policy is the bedrock of web security. But “origin” has nuances: scheme matters, port matters, path doesn’t. Subdomains aren’t same-origin (they’re same-site, different concept). CORS is opt-in cross-origin. It carries credentials only with explicit allow. Access-Control-Allow-Origin: * with credentials is invalid. Many implementations get this wrong. postMessage crosses origins by design. Receiver must validate […]
State Machines Have More Edges Than You Think
Every web app is a state machine. Order = pending → paid → shipped → delivered. State transitions have rules. The rules have gaps. Attackers enumerate edges adversarially: can I go from pending to delivered, skipping paid? Can I cancel after shipped? Can I trigger paid → paid (double payment processing)? The mindset: draw the […]
Practitioners who've
shipped the controls.
Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.
Why learn here
Practitioner-written.
Each lesson is authored by someone who has shipped the control or run the engagement in production.
Quiz after every module.
20+ questions with explanations. 70%+ to mark complete. Unlimited retries.
Progress tracked.
Completions, scores and streaks saved automatically. Resume exactly where you left off.
India-priced.
Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.